Data communication system control method, data communication system, and information processing apparatus

Abstract

Efficient management of security policies is achieved in a data communication system. In a second information processing apparatus, a general-purpose policy is managed that includes an individual policy that is a security policy applied to data transmitted from a first information processing apparatus to the second information processing apparatus. The second information processing apparatus generates an individual policy based on an individual policy request transmitted from the first information processing apparatus and on the general-purpose policy, transmitting the individual policy to the first information processing apparatus. The first information processing apparatus subjects data to be transmitted to a security processing in conformity with the received individual policy.

1 . A control method of a data communication system performing data communication in conformity with a security policy, the data communication system including a first information processing apparatus with a first CPU and a first memory and a second information processing apparatus with a second CPU and a second memory connected to the first information processing apparatus so as to be able to communicate therewith, wherein the first information processing apparatus includes an individual policy request unit and a security processing unit implemented through execution of a program stored in the first memory by the first CPU, and wherein the second information processing apparatus includes an individual policy response unit implemented through execution of a program stored in the second memory by the second CPU, the control method comprising the steps of: 
 the second information processing apparatus storing a general-purpose policy including an individual policy that is a security policy applied to data transmitted from the first information processing apparatus to the second information processing apparatus;    the individual policy request unit transmitting to the second information processing apparatus an individual policy request including extractive information on the individual policy from the general-purpose policy;    the second information processing apparatus receiving the individual policy request;    the individual policy response unit generating the individual policy from the general-purpose policy based on the extractive information included in the received individual policy request;    the second information processing apparatus transmitting to the first information processing apparatus the individual policy generated by the individual policy response unit;    the first information processing apparatus receiving the individual policy; and    the security processing unit subjecting the data to a security processing in conformity with the received individual policy when the data is transmitted from the first information processing apparatus to the second information processing apparatus.    
   
   
       2 . The control method of a data communication system of  claim 1 , wherein the individual policy request includes an identifier identifying the first information processing apparatus as the extractive information, wherein the general-purpose policy includes a security policy in correspondence with the identifier, and wherein the individual policy response unit generates the individual policy by extracting the security policy corresponding to the identifier.  
   
   
       3 . The control method of a data communication system of  claim 1 , wherein the general-purpose policy includes a security policy to the effect that the data to be transmitted from the first information processing apparatus to the second information processing apparatus should be encrypted or signed, wherein the individual policy generated by the individual policy response unit includes a security policy to the effect that the encryption or signature should be conducted, and wherein the security processing unit encrypts or signs the data when the data is transmitted from the first information processing apparatus to the second information processing apparatus.  
   
   
       4 . The control method of a data communication system of  claim 3 , wherein the general-purpose policy includes a security policy designating an algorithm used for the encryption or signature, wherein the individual policy generated by the individual policy response unit includes a security policy designating the algorithm, and wherein the security processing unit encrypts or signs the data depending on the algorithm when the data is transmitted from the first information processing apparatus to the second information processing apparatus.  
   
   
       5 . The control method of a data communication system of  claim 1 , wherein the general-purpose policy includes a security policy to the effect that the data to be transmitted from the first information processing apparatus to the second information processing apparatus should be encrypted, wherein the general-purpose policy includes an identifier identifying the second information processing apparatus decoding the data, and wherein the security processing unit encrypts the data using a public key of the second information processing apparatus.  
   
   
       6 . The control method of a data communication system of  claim 1 , wherein the individual policy request includes as the extractive information a role that is information indicating the role of the first information processing apparatus, wherein the general-purpose policy includes a security policy in correspondence with the role, and wherein the individual policy response unit generates the individual policy by extracting the security policy corresponding to the role.  
   
   
       7 . The control method of a data communication system of  claim 1 , wherein the second information processing apparatus transmits the general-purpose policy to the first information processing apparatus in response to a request from the first information processing apparatus, and wherein the security processing unit generates the individual policy from the general-purpose policy based on extractive information stored therein and subjects the data to a security processing depending on the generated individual policy when the data is transmitted from the first information processing apparatus to the second information processing apparatus.  
   
   
       8 . A control method of a data communication system performing data communication in conformity with a security policy, the data communication system including a first information processing apparatus with a first CPU and a first memory, a second information processing apparatus with a second CPU and a second memory connected to the first information processing apparatus so as to be able to communicate therewith, a third information processing apparatus with a third CPU and a third memory connected to the first and second information processing apparatuses so as to be able to communicate therewith, and a fourth information processing apparatus with a fourth CPU and a fourth memory connected to the first and second information processing apparatuses so as to be able to communicate therewith, the first information processing apparatus having a first individual policy request unit and a first security processing unit implemented through execution of a program stored in the first memory by the first CPU, the second information processing apparatus having a second individual policy request unit and a second security processing unit implemented through execution of a program stored in the second memory by the second CPU, the fourth information processing apparatus having an individual policy response unit implemented through execution of a program stored in the fourth memory by the fourth CPU, 
 wherein the fourth information processing apparatus stores a general-purpose policy including a first individual policy that is a security policy applied to data transmitted from the first information processing apparatus to the second information processing apparatus and a second individual policy that is a security policy applied to data transmitted from the second information processing apparatus to the third information processing apparatus,    wherein the first individual policy request unit transmits to the fourth information processing apparatus a first individual policy request including first extractive information that is extractive information on the first individual policy from the general-purpose policy,    wherein the second individual policy request unit transmits to the fourth information processing apparatus a second individual policy request including second extractive information that is extractive information on the second individual policy from the general-purpose policy,    wherein the fourth information processing apparatus receives the first individual policy request,    wherein the fourth information processing apparatus receives the second individual policy request,    wherein the individual policy response unit generates the first individual policy from the general-purpose policy based on the first extractive information included in the received individual policy request,    wherein the individual policy response unit generates the second individual policy from the general-purpose policy based on the second extractive information included in the received individual policy request,    wherein the fourth information processing apparatus transmits the first individual policy generated by the individual policy response unit to the first information processing apparatus,    wherein the fourth information processing apparatus transmits the second individual policy generated by the individual policy response unit to the second information processing apparatus,    wherein the first information processing apparatus receives the first individual policy,    wherein the second information processing apparatus receives the second individual policy,    wherein the first security processing unit subjects the data to a security processing depending on the received first individual policy when the data is transmitted from the first information processing apparatus to the second information processing apparatus, and    wherein the second security processing unit subjects the data to a security processing depending on the received second individual policy when the data is transmitted from the second information processing apparatus to the third information processing apparatus.    
   
   
       9 . A data communication system performing data communication in conformity with a security policy, the data communication system comprising a first information processing apparatus with a first CPU and a first memory and a second information processing apparatus with a second CPU and a second memory connected to the first information processing apparatus so as to be able to communicate therewith, 
 wherein the first information processing apparatus includes an individual policy request unit and a security processing unit implemented through execution of a program stored in the first memory by the first CPU,    wherein the second information processing apparatus includes an individual policy response unit implemented through execution of a program stored in the second memory by the second CPU,    wherein the second information processing apparatus stores a general-purpose policy including an individual policy that is a security policy applied to data transmitted from the first information processing apparatus to the second information processing apparatus,    wherein the individual policy request unit transmits to the second information processing apparatus an individual policy request including extractive information on the individual policy from the general-purpose policy,    wherein the second information processing apparatus receives the individual policy request,    wherein the individual policy response unit generates the individual policy from the general-purpose policy based on the extractive information included in the received individual policy request,    wherein the second information processing apparatus transmits to the first information processing apparatus the individual policy generated by the individual policy response unit,    wherein the first information processing apparatus receives the individual policy, and    wherein the security processing unit subjects the data to a security processing depending on the received individual policy when the data is transmitted from the first information processing apparatus to the second information processing apparatus.    
   
   
       10 . An information processing apparatus for use as the second information processing apparatus in the data communication system of  claim 9 , the information processing apparatus having the second CPU and the second memory, the information processing apparatus being connected to the first information processing apparatus so as to be able to communicate therewith, the information processing apparatus comprising the individual policy response unit implemented through execution of a program stored in the second memory by the second CPU, 
 wherein the information processing apparatus stores a general-purpose policy including an individual policy that is a security policy applied to data transmitted from the first information processing apparatus to the second information processing apparatus,    wherein the information processing apparatus receives the individual policy request transmitted from the first information processing apparatus,    wherein the individual policy response unit generates the individual policy from the general-purpose policy based on the extractive information included in the received individual policy request, and    wherein the information processing apparatus transmits the individual policy generated by the individual policy response unit to the first information processing apparatus.    
   
   
       11 . A data communication system performing data communication in conformity with a security policy, the data communication system comprising a first information processing apparatus with a first CPU and a first memory, a second information processing apparatus with a second CPU and a second memory connected to the first information processing apparatus so as to be able to communicate therewith, a third information processing apparatus with a third CPU and a third memory connected to the first and second information processing apparatuses so as to be able to communicate therewith, and a fourth information processing apparatus with a fourth CPU and a fourth memory connected to the first and second information processing apparatuses so as to be able to communicate therewith, 
 wherein the first information processing apparatus includes a first individual policy request unit and a first security processing unit implemented through execution of a program stored in the first memory by the first CPU,    wherein the second information processing apparatus includes a second individual policy request unit and a second security processing unit implemented through execution of a program stored in the second memory by the second CPU,    wherein the fourth information processing apparatus includes an individual policy response unit implemented through execution of a program stored in the fourth memory by the fourth CPU,    wherein the fourth information processing apparatus stores a general-purpose policy, the general-purpose policy including a first individual policy that is a security policy applied to data transmitted from the first information processing apparatus to the second information processing apparatus and a second individual policy that is a security policy applied to data transmitted from the second information processing apparatus to a third information processing apparatus,    wherein the first individual policy request unit transmits to the fourth information processing apparatus a first individual policy request including first extractive information that is extractive information on the first individual policy from the general-purpose policy,    wherein the second individual policy request unit transmits to the fourth information processing apparatus a second individual policy request including second extractive information that is extractive information on the second individual policy from the general-purpose policy,    wherein the fourth information processing apparatus receives the first individual policy request,    wherein the fourth information processing apparatus receives the second individual policy request,    wherein the individual policy response unit generates the first individual policy from the general-purpose policy based on the first extractive information included in the received individual policy request,    wherein the individual policy response unit generates the second individual policy from the general-purpose policy based on the second extractive information included in the received individual policy request,    wherein the fourth information processing apparatus transmits the first individual policy generated by the individual policy response unit to the first information processing apparatus,    wherein the fourth information processing apparatus transmits the second individual policy generated by the individual policy response unit to the second information processing apparatus,    wherein the first information processing apparatus receives the first individual policy,    wherein the second information processing apparatus receives the second individual policy,    wherein the first security processing unit subjects the data to a security processing depending on the received first individual policy when the data is transmitted from the first information processing apparatus to the second information processing apparatus, and    wherein the second security processing unit subjects the data to a security processing depending on the received second individual policy when the data is transmitted from the second information processing apparatus to the third information processing apparatus.    
   
   
       12 . An information processing apparatus for use as the fourth information processing apparatus in the data communication system of  claim 11 , the information processing apparatus having the fourth CPU and the fourth memory and being connected to the first and second information processing apparatuses so as to be able to communicate therewith, the information processing apparatus comprising the individual policy response unit implemented through execution of a program stored in the fourth memory by the fourth CPU, 
 wherein the information processing apparatus stores a general-purpose policy, the general-purpose policy including a first individual policy that is a security policy applied to data transmitted from the first information processing apparatus to the second information processing apparatus and a second individual policy that is a security policy applied to data transmitted from the second information processing apparatus to a third information processing apparatus,    wherein the information processing apparatus receives the first individual policy request,    wherein the information processing apparatus receives the second individual policy request,    wherein the individual policy response unit generates the first individual policy from the general-purpose policy based on the first extractive information included in the received individual policy request,    wherein the individual policy response unit generates the second individual policy from the general-purpose policy based on the second extractive information included in the received individual policy request,    wherein the information processing apparatus transmits the first individual policy generated by the individual policy response unit to the first information processing apparatus, and    wherein the information processing apparatus transmits the second individual policy generated by the individual policy response unit to the second information processing apparatus.